Koha Community vulnerabilities
We track 15 vulnerabilities in Koha Community products across 2 products. 15 are rated high or critical, and none are known to be exploited. The most recent was published on October 14, 2026.
Latest Koha Community vulnerabilities
- 7.6 High severity
Koha: Improper Neutralization of Special Elements used in an SQL Command
Koha is vulnerable to SQL injection in the Most-circulated items report. The reports/cat_issues_top.pl script (sub calculate) concatenates the user-controlled Criteria, Filter, and Limit request parameters directly into dynamic SQL. Criteria is only prefix-nor
- 8.8 High severity
Koha: Improper Neutralization of Special Elements used in an OS Command
Koha is vulnerable to OS command injection in the Task Scheduler deletion path. The tools/scheduler.pl handler accepts the jobid request parameter for op=cud-delete and passes it to C4::Scheduler::remove_at_job without validating it. Schedule::At::remove subst
- 7.1 High severity
Koha: Improper Neutralization of Special Elements used in an SQL Command
An SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authenticated staff with the acquisition => order_receive permission to read arbitrary database contents via the orderby request parameter in acqui/parcels.pl. The
- 7.1 High severity
Koha: Improper Neutralization of Special Elements used in an SQL Command
A stored SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authenticated staff with the tools => items_batchmod permission to read arbitrary database contents by storing a SQL payload in the agefield value of an auto
- 8.8 High severity
Koha: Improper Neutralization of Special Elements used in an SQL Command
Koha's guided report builder (reports/guided_reports.pl) reads the CGI parameter and, for each value, a dynamically-named parameter, and concatenates both directly into an SQL ORDER BY clause with no allowlist or validation. Since ORDER BY columns cannot be bo
- 8.8 High severity
Koha: Improper Neutralization of Special Elements used in an SQL Command
Koha's reports/issues_stats.pl (the circulation statistics report) builds its calculation query in sub calculate by concatenating several user-controlled request parameters directly into the SQL string. The PeriodTypeSel, PeriodDaySel, and PeriodMonthSel param
- 8.8 High severity
Koha: Improper Neutralization of Special Elements used in an SQL Command
Koha's reports/bor_issues_top.pl builds dynamic SQL in sub calculate by concatenating several user-controlled request parameters directly into the query string. An authenticated staff user holding the reports module permission can inject arbitrary SQL and read
- 8.8 High severity
Koha: Improper Neutralization of Special Elements used in an SQL Command
Koha's reports/issues_avg_stats.pl builds dynamic SQL in sub calculate by concatenating several user-controlled request parameters directly into the query string. The Line and Column parameters are not validated against any whitelist and land verbatim in ident
- 8.8 High severity
Koha: Improper Neutralization of Special Elements used in an SQL Command
Koha's reports/catalogue_stats.pl builds dynamic SQL in sub calculate by interpolating the user-controlled Line and Column request parameters directly into identifier positions of the query (SELECT DISTINCTROW, GROUP BY, ORDER BY) with no whitelist validation.
- 8.8 High severity
Koha: Improper Neutralization of Special Elements used in an SQL Command
Koha's reports/acquisitions_stats.pl builds its per-cell statistics query in sub calculate by interpolating the user-controlled Filter request parameters directly into WHERE fragments covering aqbasket.closedate, aqorders.datereceived, aqbooksellers.name, item
- 7.6 High severity
Koha: Improper Neutralization of Special Elements used in an SQL Command
SQL Injection in reports/catalogue_out.pl in Koha Community Koha through 22.11.37, 23.x, 24.x before 24.11.16, 25.05.x before 25.05.11, 25.11.x before 25.11.05, 26.05.x before 26.05.01, and 26.11.x before 26.11.00 allows an authenticated staff user with the Re
- 8.8 High severity
Koha: Improper Neutralization of Special Elements used in an SQL Command
An authenticated SQL Injection vulnerability (CWE-89) exists in the Koha staff interface in the /cgi-bin/koha/suggestion/suggestion.pl endpoint due to improper validation of the displayby parameter used by the GetDistinctValues functionality. Successful exploi
- 8.1 High severity
koha_library_software: Cross-Site Request Forgery
A multiple Cross-site scripting (XSS) vulnerability in the '/members/moremember.pl', and ‘/members/members-home.pl’ endpoints within Koha Library Management System version 23.05.05 and earlier allows malicious staff users to carry out CSRF attacks, including u
- 8.0 High severity
koha_library_software: Improper Neutralization of Formula Elements in a CSV File
CSV Injection vulnerability in '/members/moremember.pl' and '/admin/aqbudgets.pl' endpoints in Koha Library Management System version 23.05.05 and earlier allows attackers to to inject DDE commands into csv exports via the 'Budget' and 'Patrons Member' compone
- 7.5 High severity
Koha Library Software: Improper Neutralization of Special Elements used in an SQL Command
SQL Injection vulnerability in Koha Library Software 23.0.5.04 and before allows a remote attacker to obtain sensitive information via the intranet/cgi bin/cataloging/ysearch.pl. component.